WordPress Vulnerabilities

WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Search Block

Description

An authenticated user could customise the class of the search block, leading to Cross-Site Scripting (XSS)

Affects WordPress

5.4
Fixed in WordPress 5.4.1
5.3.2
Fixed in WordPress 5.3.3
5.3.1
Fixed in WordPress 5.3.3
5.3
Fixed in WordPress 5.3.3
5.2.5
Fixed in WordPress 5.2.6
5.2.4
Fixed in WordPress 5.2.6
5.2.3
Fixed in WordPress 5.2.6
5.2.2
Fixed in WordPress 5.2.6
5.2.1
Fixed in WordPress 5.2.6
5.2
Fixed in WordPress 5.2.6

References

CVE
CVE-2020-11030
URL
https://wordpress.org/news/2020/04/wordpress-5-4-1/
URL
https://core.trac.wordpress.org/changeset/47636/
URL
https://www.wordfence.com/blog/2020/04/unpacking-the-7-vulnerabilities-fixed-in-todays-wordpress-5-4-1-security-update/
URL
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-vccm-6gmc-qhjh

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.3 (low)

Miscellaneous

Original Researcher
Ben Bidner
Submitter
Ryan
Verified
No
WPVDB ID
e4bda91b-067d-45e4-a8be-672ccf8b1a06

Timeline

Publicly Published
2020-04-29 (about 6 years ago)
Added
2020-04-30 (about 6 years ago)
Last Updated
2020-05-02 (about 6 years ago)

Other

Published
Title
Published
2024-04-15
Title
Shortcodes and extra features for Phlox theme < 2.15.6 - Contributor+ Stored XSS via Accordion Widget
Published
2024-12-05
Title
Wot Elementor Widgets <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2017-04-12
Title
Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)
Published
2025-02-12
Title
WP Activity Log < 5.3.0 - Unauthenticated Stored XSS
Published
2023-11-29
Title
Site Offline < 1.5.7 - Admin+ Stored XSS